HIPAA-Friendly Calendar and Appointment Apps

You won’t find any mention of HIPAA or Business Associate Agreements on the Calendly website. Even the Help Center turns up no search results for the terms.There is a privacy and security page that covers Calendly’s commitment to trust, its physical infrastructure, PCI certification, security best practices, and GDPR compliance, but again, there’s no mention of HIPAA. In case of concerns about whether Calendly complies with HIPAA and in the absence of any information from Calendly on HIPAA compliance, those who need to abide by HIPAA regulations may want to look for a different scheduling tool.

Acuity Scheduling is part of the Squarespace platform. While many aspects of Squarespace may not enable HIPAA compliance, Acuity Scheduling includes features designed to allow covered entities to comply with HIPAA regulations.Customers can manage notification settings to limit access to protected health information (PHI). For example, they can prevent emails from displaying the from and reply-to fields that show the patient’s name and email address. You can contact Acuity to disable the feature that attaches a calendar file (ICS invite) containing the client’s name, appointment time, and appointment type to appointment confirmation and rescheduling messages.Covered entities should sign up for the Powerhouse Player plan to enable security features required for HIPAA compliance. Access the Customize Appearance section to manage Scheduling Page Options, and then select the option to enter into a BAA using an electronic signature.

Google Calendar is a service offered through Google Workspace (formerly G Suite) that makes it easy for users to track appointments and manage their schedules. This tool appears to ensure the safety of PHI, as long as you configure the security, access, and audit settings to prevent the disclosure or misuse of PHI.The default settings in Google Calendar share all information with team members in your domain. Security features allow you to set meetings that involve PHI to “Private” to maintain confidentiality. This setting shows the time as “Busy” without disclosing information about the meeting. With proper privacy settings, the program won’t include PHI, such as the title and description, in the meeting details.Covered entities should be on a paid Google Workspace Business or Enterprise plan. Paid plans give users the option to manage Google Calendar security controls to meet HIPAA requirements.

Vargaro serves three business sectors — beauty, wellness, and fitness. The only time HIPAA is mentioned on the Vagaro website is under its wellness offerings, specifically its medical spa management software. Vagaro claims its all-in-one booking and management software is HIPAA and EMR compliant but doesn’t provide any details. Business Associate Agreements (BAAs) aren’t mentioned on the site.

Mindbody has proactive security measures that appear to meet HIPAA regulations. The company has obtained PCI Level 1 certification, and states that it completes an annual audit and HIPAA risk assessment.HIPAA-related privacy features include network security, encryption, ePHI protection, access control measures, and a Vulnerability Management Program. System alerts are in place to notify admins of unauthorized access.Mindbody offers PHI-related protections for appointment scheduling, contact logs, documents, and transactions. Progress notes allow covered entities to record personal information that’s accessible only by authorized personnel.A business associate agreement (BAA) must be in place before using Mindbody for PHI. Covered entities can email Mindbody to request a signed BAA.